False Positive/Negative: #844
Comments
|
Do you have an issue to report? No info here. |
|
Thx @sullo for being reactive! Here is one of my scan ➜ program git:(master) ./nikto.pl -h http://localhost:9086/
- Nikto v2.5.0
---------------------------------------------------------------------------
+ ERROR: Unable to open database file db_headers_suggested: .
+ Target IP: 127.0.0.1
+ Target Hostname: localhost
+ Target Port: 9086
+ Start Time: 2024-11-01 14:29:13 (GMT1)
---------------------------------------------------------------------------
+ Server: No banner retrieved
+ No CGI Directories found (use '-C all' to force check all possible dirs)
called once
+ /servlet/org.apache.catalina.Globals/<script>alert('Vulnerable')</script>: Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes.
+ /ss000007.pl?PRODREF=<script>alert('Vulnerable')</script>: Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1732
+ /modules.php?op=modload&name=Members_List&file=index&letter=<script>alert('Vulnerable')</script>: This install of PHP-Nuke's modules.php is vulnerable to Cross Site Scripting (XSS).
+ /html/partner.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>: myphpnuke version 1.8.8_final_7 is vulnerable to Cross Site Scripting (XSS).
+ /article.cfm?id=1'<script>alert(document.cookie);</script>: With malformed URLs, ColdFusion is vulnerable to Cross Site Scripting (XSS).
+ /diapo.php?rep=<script>alert(document.cookie)</script>: GPhotos index.php rep Variable XSS. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2397
+ /admin/cfg/configscreen.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /admin/cfg/configsite.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /admin/cfg/configsql.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /admin/modules/cache.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /admin/settings.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /functions.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /modules/Downloads/voteinclude.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /modules/WebChat/in.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /modules/Your_Account/navbar.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /options.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /shop/php_files/site.config.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /uifc/MultFileUploadHandler.php+: This might be interesting: has been seen in web logs from an unknown scanner.
+ /index.html.ru.iso-ru: Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information. See: CWE-552
+ /aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551089&desc=<script>alert('Vulnerable')</script>: Aktivate Shopping Cart 1.03 and lower are vulnerable to Cross Site Scripting (XSS). See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1212
+ /sysuser/docmgr/info.stm?path=<script>alert(document.cookie)</script>: Sambar Server default script is vulnerable to Cross Site Scripting (XSS). See: https://seclists.org/fulldisclosure/2003/Mar/265
+ /pls/portal/PORTAL.wwv_ui_lovf.show: Access to Oracle pages could have an unknown impact.
+ /pls/portal/PORTAL.wwv_dynxml_generator.show: Access to Oracle pages could have an unknown impact.
+ /login.cgi?cli=aa%20aa%27cat%20/etc/hosts: Some D-Link router remote command execution.
+ 7856 requests: 0 error(s) and 24 item(s) reported on remote host
+ End Time: 2024-11-01 14:29:32 (GMT1) (19 seconds)
---------------------------------------------------------------------------
+ 1 host(s) testedAll that are false positive since in all cases my server returns a 404 response without a body or a content. Maybe I did something wrong (it's my 1st time using the tool so sorry if it's a dumb question. |
|
We'd need to see the actual full HTTP 404 response to assist with reducing
the FPs.
…On Fri, Nov 1, 2024 at 9:34 AM TOPKAT ***@***.***> wrote:
Here is one of my scan
➜ program git:(master) ./nikto.pl -h http://localhost:9086/
- Nikto v2.5.0
---------------------------------------------------------------------------
+ ERROR: Unable to open database file db_headers_suggested: .
+ Target IP: 127.0.0.1
+ Target Hostname: localhost
+ Target Port: 9086
+ Start Time: 2024-11-01 14:29:13 (GMT1)
---------------------------------------------------------------------------
+ Server: No banner retrieved
+ No CGI Directories found (use '-C all' to force check all possible dirs)
called once
+ /servlet/org.apache.catalina.Globals/<script>alert('Vulnerable')</script>: Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes.
+ /ss000007.pl?PRODREF=<script>alert('Vulnerable')</script>: Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1732
+ /modules.php?op=modload&name=Members_List&file=index&letter=<script>alert('Vulnerable')</script>: This install of PHP-Nuke's modules.php is vulnerable to Cross Site Scripting (XSS).+ /html/partner.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>: myphpnuke version 1.8.8_final_7 is vulnerable to Cross Site Scripting (XSS).
+ /article.cfm?id=1'<script>alert(document.cookie);</script>: With malformed URLs, ColdFusion is vulnerable to Cross Site Scripting (XSS).+ /diapo.php?rep=<script>alert(document.cookie)</script>: GPhotos index.php rep Variable XSS. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2397+ /admin/cfg/configscreen.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /admin/cfg/configsite.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /admin/cfg/configsql.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /admin/modules/cache.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /admin/settings.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /functions.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /modules/Downloads/voteinclude.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /modules/WebChat/in.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /modules/Your_Account/navbar.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /options.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /shop/php_files/site.config.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /uifc/MultFileUploadHandler.php+: This might be interesting: has been seen in web logs from an unknown scanner.+ /index.html.ru.iso-ru: Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information. See: CWE-552+ /aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551089&desc=<script>alert('Vulnerable')</script>: Aktivate Shopping Cart 1.03 and lower are vulnerable to Cross Site Scripting (XSS). See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1212+ /sysuser/docmgr/info.stm?path=<script>alert(document.cookie)</script>: Sambar Server default script is vulnerable to Cross Site Scripting (XSS). See: https://seclists.org/fulldisclosure/2003/Mar/265+ /pls/portal/PORTAL.wwv_ui_lovf.show: Access to Oracle pages could have an unknown impact.+ /pls/portal/PORTAL.wwv_dynxml_generator.show: Access to Oracle pages could have an unknown impact.+ /login.cgi?cli=aa%20aa%27cat%20/etc/hosts: Some D-Link router remote command execution.+ 7856 requests: 0 error(s) and 24 item(s) reported on remote host+ End Time: 2024-11-01 14:29:32 (GMT1) (19 seconds)---------------------------------------------------------------------------+ 1 host(s) tested
All that are false positive since in all cases my server returns a 404
response without a body or a content.
Maybe I did something wrong (it's my 1st time using the tool so sorry if
it's a dumb question.
—
Reply to this email directly, view it on GitHub
<#844 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AALICRFBO5V5SB7TDK4K7TDZ6N7M5AVCNFSM6AAAAABPEFH7OWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINJRHA4DCNBUGA>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
|
Here is a postman screenshot 
This is a straight 404 with no content |
|
We need the raw response not interpreted by postman or anything. try using curl. |
|
Thx for helping there, here is the result of the If I don't set the -v option, it doesn't return a thing |
|
Well that wasn't helpful. Can you try this one? |
|
|
I can't offer a suggestion at this point. I don't see any obvious reason why it is giving a FP. Nikto works by analyzing the HTTP response and looking for a certain code or response content matching. In the cases you pasted, it is responding with a 404 so Nikto should not be confused and report FP on some of them which are looking for a 200 response. My best guess is the 404 detection has misidentified how the server works. I can't really troubleshoot that further since I don't have direct access to the server/configuration/app. We might get a clue into the 404 detection if you run this and paste the output: It should look something like this: |
|
This doesn't exactly look like what you provided...it's an extremely long output, here is an extract: Maybe it's worth mentionning I am on MacOs ? Details
D:Fri Nov 1 15:11:38 2024 'Result Hash' = { |
|
Ahh crap, I mis-typed. Use |
|
Here it is! |
|
There is absolutely no reason it should be giving a FP on I think this is the end of my ability to troubleshoot w/o access to the server. Unfortunately it looks like a code bug and that would take time to track down and a complicated fix, which is fine but... I can't access the system. |
|
Ok thx for that investigation by the way, I'll be there if you need further informations :) |
|
Seeing as we have the output from curl -v , couldn't we put together a
dummy page that returns the exact output to see if there is a match?
…On Fri, 1 Nov 2024, 14:55 TOPKAT, ***@***.***> wrote:
Ok thx for that investigation by the way, I'll be there if you need
further informations :)
—
Reply to this email directly, view it on GitHub
<#844 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAA4SWLS2BQHXXXPTSKJ3CDZ6OI7NAVCNFSM6AAAAABPEFH7OWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINJSGAYTEOJTGY>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
|
@digininja if you create it'll test it :) |
|
Challenge finally accepted! The false positive is on the last line. |
finally getting around to this on my vacation... @digininja your response is a 200 OK, which triggers it, but is not the same condition as the OP (which is a 404). Even forcing the response to 404 in the code doesn't give me the FP. @Gitabhsuosowo are you still able to help debug? this will make it run faster and just the one test if you can. when done, look in the created "savedir_*" folder and there should be one file. In it, we are looking for this on that configtest.php response: that Reason answer wll help debug. thanks! |
|
It is returning a 404 now in case it helps.
…On Thu, 26 Dec 2024 at 19:20, sullo ***@***.***> wrote:
< HTTP/1.1 404 Not Found
finally getting around to this on my vacation... @digininja
<https://github.com/digininja> your response is a 200 OK, which triggers
it, but is not the same condition as the OP (which is a 404). Even forcing
the response to 404 in the code doesn't give me the FP.
@Gitabhsuosowo <https://github.com/Gitabhsuosowo> are you still able to
help debug? this will make it run faster and just the one test if you can.
grep configscreen.inc.php databases/db_tests > databases/udb_tests
./nikto.pl -h [TARGET] -S . -Cgidirs none -Userdbs tests -Plugins "@@NONE;tests;404;fileops"
when done, look in the created "savedir_*" folder and there should be one
file. In it, we are looking for this on that configtest.php response:
Test ID: 002272
References:
Message: /admin/cfg/configscreen.inc.php+: This might be interesting: has been seen in web logs from an unknown scanner.
Reason: Response Code Match
that *Reason* answer wll help debug. thanks!
—
Reply to this email directly, view it on GitHub
<#844 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAA4SWNOZPS3TSGRMYQPWGT2HRJIXAVCNFSM6AAAAABPEFH7OWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNRTGA2DEMZVGU>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
working fine now 💀 not sure what else to do at this point. |
Output of suspected false positive / negative
Post any useful information like the ID of the test causing the false positive.
Debug output
Run:
This saves all positive responses to a new
false_positivedirectory. Afterwards lookfor the related ID of the false positive / negative and paste it below.
The text was updated successfully, but these errors were encountered: